CVE-2023-3595
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk88th percentile - higher than 88% of all known CVEs
Summary
The vulnerability in Rockwell Automation 1756 EN2* and 1756 EN3* ControlLogix communication products could allow a malicious user to perform remote code execution with persistence on the target system through maliciously crafted CIP messages. This includes the ability to modify, deny, and exfiltrate data passing through the device.
Risk Assessment
This threat could lead to serious security breaches, including data loss and unauthorized access to control systems within the organization.
Recommendation
It is recommended to update the software to the latest version and implement appropriate security measures to minimize the risk associated with this vulnerability.
Original NVD description (English source)
Where this vulnerability exists in the Rockwell Automation 1756 EN2* and 1756 EN3* ControlLogix communication products, it could allow a malicious user to perform remote code execution with persistence on the target system through maliciously crafted CIP messages. This includes the ability to modify, deny, and exfiltrate data passing through the device.